DVA-C02 Question 283
Single answerYou are developing a serverless application using AWS Lambda and need to securely store sensitive configuration values such as API keys and database credentials. These values should be easily accessible by your Lambda function, but must remain encrypted at rest and protected during retrieval. Which AWS service should you use to meet these requirements?
- A
AWS Secrets Manager
- B
Amazon S3
- C
AWS Key Management Service (KMS)
- D
AWS Systems Manager Parameter Store
Show answer and explanation
Correct answer: A
Explanation
AWS Secrets Manager is the optimal choice for storing sensitive configuration values in a secure and scalable manner. It integrates seamlessly with AWS Lambda, encrypts secrets at rest using AWS KMS, and provides built-in support for automatic rotation of secrets. While other services like Parameter Store and KMS have related capabilities, they do not offer the full suite of features specific to secret management that AWS Secrets Manager provides.
- A. Correct.
AWS Secrets Manager is designed specifically for securely storing and managing sensitive information such as API keys, passwords, and other secrets. It supports encryption at rest and seamless integration with AWS Lambda.
- B. Incorrect.
Amazon S3 is a general-purpose object storage service and is not intended for storing sensitive configuration values like secrets or API keys. While you can encrypt data in S3, it does not provide the same level of secret management features as AWS Secrets Manager.
- C. Incorrect.
AWS Key Management Service (KMS) is a service for managing encryption keys. While KMS is used under the hood by AWS Secrets Manager and other services, it does not directly manage secrets or configuration values.
- D. Incorrect.
AWS Systems Manager Parameter Store can store configuration values, including encrypted ones. However, it is not as feature-rich as AWS Secrets Manager when it comes to lifecycle management, rotation, and fine-grained access control for secrets.